A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).
If you wanted to get help with moderating your own community then head over to [email protected]!
Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration), Search Lemmy
Isn't there a mechanism for this? If the receiving instance doest respond the sending instance marks it as dead.
I think they do get marked as dead after the Bodis subdomain does not act as a Lemmy instance. But I was wondering if a large number of instances "waking up from the dead" and acting maliciously could cause some trouble. Or would such "undead" instances pose no more threat to the fediverse than the same number of newly created malicious instances ? I'm mainly thinking about stuff like being in a privileged position to DoS most instances at once, or impersonation of accounts that used to actually exist on these "undead" instances
From what I can tell, an instance is either 'linked' (federated) or 'blocked' (defederated) on Lemmy. Mastodon has some more granularity. If an instance came back as a zombie, it wouldn't be any more powerful privilege wise than a new instance that is malicious. It would get defederated same as always.
What could be a problem is on the individual user level. Say that a lot of users sort their feed by subscribed. They are not affected by random instances coming and going. However, they will be affected if a bunch of their (dead) subscribed communities suddenly become malicious.
Anyway, I hope this at least serves as a reminder to not let our domains expire ;)
It's an important point for sure.
Your sensitive data and logins are tied to email addresses, which are tied to domains. Lose your domain, someone can access everything.
Your sensitive data and logins are tied to email addresses, which are tied to domains. Lose your domain, someone can access everything.
I recently stumbled upon an article showing how bad this can be when the expired domains were used for important/serious stuff
My experience from when my backend server died, and Lemmy instances were getting a 502 response to ActivityPub POST activity, they eventually stopped sending anything. They kept trying to GET stuff though (user account details, nodeinfo responses), and lemmy.ml has never stopped POSTing, even though I configured nginx to always respond 403 to anything from them for about a year now.
never stopped POSTing, even though I configured nginx to always respond 403 to anything from them for about a year now.
Lol, there are definitely some stubborn user agents out there. I've been serving 418 to a bunch of SEO crawlers - with fail2ban configured to drop all packets from their IPs/CIDR ranges after some attemps - for a few months now. They keep coming at the same rate as soon as they get unbanned. I guess they keep sending requests into the void for the whole ban duration.
Using 418 for undesirable requests instead of a more common status code (such as 403) lets me easily filter these blocks in fail2ban, which can help weed out a lot of noise in server logs.
That's a really good idea. I'll have to remember that.